Browser extension · Chrome and Edge
The Share Auth browser extension
On the sign-in page of a shared account, one click is enough: the extension finds your team's code for that site and fills it into the page.
Available on the Chrome Web Store, for Chrome, Edge and other Chromium-based browsers.
What it does
You are on the sign-in page of an account your team shares, and the site asks for its six-digit code. Click the Share Auth icon and the extension reads the site’s address, asks your vault for that account’s code and fills it into the page. There is no other tab to open and no code to copy across.
It works on the active team of your Share Auth account, with the same permissions you have on the website.
How it finds the right account
Each secret can carry the list of sites it belongs to, in the Sites field
of its edit page. That is the reliable match: github.com also answers for
gist.github.com, but a stored site never answers for a neighbouring domain.
When no secret claims the site, Share Auth tries a match on the account’s name
and issuer (github.com finds a secret called “GitHub”). The extension flags
those results as guesses, since they can be wrong. It only reads the main
domain name, so a lookalike site such as github.com.example.net cannot pass itself
off as GitHub.
What it is allowed to do
The extension’s token is limited to two permissions: listing accounts and getting a code. It cannot change anything, and you can revoke it at any time from your profile, among your API tokens.
Its browser permissions, and what each one is for:
- active tab: read the site’s address and fill in the code, only after your click;
- scripting: fill the code into the page;
- storage: keep your server’s address and the token;
- identity: open the Share Auth sign-in window, without reading any Google account;
- a single site: your Share Auth server, and no other.
The extension has no standing access to any site. By default the token stays in memory for the session and is gone when the browser closes; staying signed in for longer is an option.
How you sign in
From the extension’s settings, Sign in with ShareAuth opens a window on your server. If you are already signed in there, you only need to confirm; otherwise you sign in, second factor included. You are asked for your password again if you have not entered it in the last fifteen minutes, so a session left open is not enough to connect a new device.
Frequently asked questions
From the Chrome Web Store. Edge and other Chromium-based browsers install it from the same listing.
Chrome, Edge and other Chromium-based browsers, from version 102. Firefox and Safari are not supported for now.
No. Its token allows exactly two things: listing the team's accounts and getting their current code. It cannot create, edit or delete anything, and it has no access to teams, integrations or logs.
Yes, just like those from the website and the API. Every code obtained appears in the team's access log, under the name of the person signed in.
The extension offers all of them and you choose. If none matches, it shows the full list of the team's accounts.